added .htaccess deny's to storage locations